From d80f8ebcf079912d71653d29e02020e9b4f5d303 Mon Sep 17 00:00:00 2001
From: Mathieu Audebert <mathieu@sakuga.dev>
Date: Tue, 13 Oct 2026 15:27:02 +0200
Subject: [PATCH 1/3] test(worker): a visitor with no account leaves a note, on
 a worker with accounts (FRU-224)

Mathieu, 2026-10-13: an account is always possible for whoever administers, and is not needed to
leave a note. The code did it already, and no test held the whole path on a worker whose sites come
from the console: the ones that did ran on FRUITBACK_CLIENTS, which is going.

- `visitor.test.ts`: a site made through the console, a note with no session, no token and no
  cookie, read again, refused from another origin; a site for members answers 401 to a read.
- `e2e/visitor.spec.ts`: the same in a browser, where CORS stops a page of another origin.
- Measured, and written in SECURITY.md: a site for members still takes a note that has no session.
- The token signed by the site is not decided, and nothing here changes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 SECURITY.md                     |  22 ++++
 apps/worker/src/visitor.test.ts | 205 ++++++++++++++++++++++++++++++++
 docs/decisions/worker.md        |  22 ++++
 docs/modes.md                   |  16 +++
 e2e/visitor.spec.ts             | 116 ++++++++++++++++++
 5 files changed, 381 insertions(+)
 create mode 100644 apps/worker/src/visitor.test.ts
 create mode 100644 e2e/visitor.spec.ts

diff --git a/SECURITY.md b/SECURITY.md
index 475735ad..5b8d7dd1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -538,6 +538,28 @@ client**: an empty map is not the absence of a map, which would answer every pag
 file holds addresses, names and the id each provider gives a person, no password, and no token of a provider
 that signs a person in. Since FRU-121 it also holds the key of each connector, encrypted: see below. `FRUITBACK_CLIENTS` is refused beside it, so one map has one source.
 
+**A visitor with no account leaves a note on a site that everyone reads, and that is the design**
+(FRU-224, a decision of 2026-10-13): no session, no token, no cookie. The page sends the id of the
+site and the browser sends its `Origin`; the worker refuses an origin that is no site of the worker
+(`origin-not-allowed`) and the origin of another site (`origin-not-allowed-for-client`), and keeps
+the name the visitor typed as a claim, never as verified. `visitor.test.ts` holds that path on a
+worker whose site was made in the console, with the notes in PostgreSQL:
+test:`leaves a note and reads it again, with no session, no token and no cookie`,
+test:`refuses a note and a read that name the site from the page of another site`,
+test:`keeps the name the visitor typed, and never says the worker verified it`. In a browser,
+`e2e/visitor.spec.ts` adds what CORS does: test:`a page of another origin reads no note of the site,
+and plants none`. As above, `Origin` binds a claim to a site and authenticates nobody: a request
+that is not from a browser sends the one it wants, or none.
+
+**The visibility of a site decides who reads it, and not who writes on it.** On a site read by
+`members`, a read with no session answers `401`
+(test:`reads no note: the worker asks for a session, and says so`). **A note sent with no session is
+still kept there**, as a claim, as on every site: its sender cannot read it back, and the members
+find it, in the worker or in the tracker of the site
+(test:`still takes a note sent with no session, which its sender cannot read back`). This is what
+the worker did before FRU-224, measured there, and not a choice made there. A team that wants
+notes from its members only has no setting for it today.
+
 **With `FRUITBACK_DATABASE_URL` the same accounts are in a PostgreSQL database** (FRU-141), in place
 of that file, and the worker refuses to start with both. The database holds what the file holds:
 addresses, names, the id each provider gives a person,
diff --git a/apps/worker/src/visitor.test.ts b/apps/worker/src/visitor.test.ts
new file mode 100644
index 00000000..04202b00
--- /dev/null
+++ b/apps/worker/src/visitor.test.ts
@@ -0,0 +1,205 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { type Seed, canonicalizePageUrl } from '@fruitback/shared';
+import { seedFixture } from '@fruitback/shared/seed.fixture';
+import { type World, callOn, signInTo, workspaceIn, worlds } from './console-world.fixture.ts';
+import { rowsOf } from './postgres.fixture.ts';
+import { createPostgresSeedStore } from './seeds-postgres.ts';
+
+/**
+ * A visitor leaves a note with no account (FRU-224), on a worker that has accounts.
+ *
+ * Mathieu, 2026-10-13: « on peut créer un compte quoiqu'il arrive aussi pour la partie admin, par
+ * contre pas forcément besoin de compte pour laisser des notes côté user ». The code was there: a
+ * site that everyone reads takes a note from a page with no session and no token. No test held the
+ * whole path on a worker whose sites come from the console: the ones that did ran on
+ * `FRUITBACK_CLIENTS`, which is going (FRU-184).
+ *
+ * Each case goes through `handleRequest`, on PostgreSQL (PGlite), with better-auth on. An admin
+ * signs in and makes the site through the route of the console. The visitor then sends what the
+ * `<script>` of the site sends: the id of the site, the `Origin` of the page, and nothing else. The
+ * notes are in the store of the database (FRU-218).
+ */
+
+const SITE = 'https://staging.acme.test';
+/** The origin of a site of another workspace of the worker, and one that is no site of anybody. */
+const SERVED = 'https://staging.globex.test';
+const NOWHERE = 'https://elsewhere.example';
+const PAGE = canonicalizePageUrl(`${SITE}/pricing`);
+
+const envOf = worlds();
+
+function noteFor(site: string, more: Partial<Seed> = {}): Seed {
+  const seed = seedFixture({ id: 'sd_visitor', page: { url: PAGE, path: '/pricing', title: 'Pricing' } });
+  const { client: _own, ...rest } = seed;
+
+  return { ...rest, client: { id: site, name: 'Acme' }, ...more };
+}
+
+/** A worker with one workspace, and the site that its admin made in the console. */
+async function workerWithASite(visibility: 'everyone' | 'members') {
+  const world = await envOf({ env: { FRUITBACK_STORE: 'postgres' } });
+  const admin = await signInTo(world, 'ana@acme.dev');
+  const workspace = await workspaceIn(world, admin.token);
+  const made = await callOn(world, 'POST', `/console/workspaces/${workspace}/sites`, {
+    token: admin.token,
+    body: { url: `${SITE}/pricing?tab=annual`, visibility },
+  });
+  assert.equal(made.status, 201, await made.clone().text());
+  const site = ((await made.json()) as { id: string }).id;
+  const store = createPostgresSeedStore(world.database);
+
+  /** What a page sends: an `Origin`, and no `Authorization` and no `Cookie`. `null` is no `Origin` at all. */
+  const visitor = {
+    send: (origin: string | null, note: Seed = noteFor(site)) =>
+      callOn(world, 'POST', '/feedback', { origin, body: note }, { store }),
+    read: (origin: string | null, client = site) =>
+      callOn(world, 'GET', `/feedback?url=${encodeURIComponent(PAGE)}&client=${client}`, { origin }, { store }),
+  };
+
+  return { world, admin, workspace, site, store, visitor };
+}
+
+async function notesOf(answer: Response): Promise<{ note: string; verified: unknown; name: unknown }[]> {
+  assert.equal(answer.status, 200, await answer.clone().text());
+  const { issues } = (await answer.json()) as {
+    issues: { seed: { note: string; reporter?: { verified?: boolean; name?: string } } }[];
+  };
+
+  return issues.map((issue) => ({
+    note: issue.seed.note,
+    verified: issue.seed.reporter?.verified,
+    name: issue.seed.reporter?.name,
+  }));
+}
+
+const rowsIn = async (world: World): Promise<number> =>
+  Number((await rowsOf(world.database, 'SELECT count(*)::int AS n FROM seeds'))[0]?.n);
+
+describe('a visitor with no account, on a site that everyone reads (FRU-224)', () => {
+  it('leaves a note and reads it again, with no session, no token and no cookie', async () => {
+    const { world, visitor } = await workerWithASite('everyone');
+
+    const sent = await visitor.send(SITE, noteFor('ignored', { note: 'The button is too small.' }));
+    // The note names a site that is not one: the control of the next lines, which name the right one.
+    assert.equal(sent.status, 400, await sent.clone().text());
+    assert.equal(await rowsIn(world), 0);
+
+    const { site } = { site: (await rowsOf(world.database, 'SELECT id FROM sites'))[0]?.id as string };
+    const kept = await visitor.send(SITE, noteFor(site, { note: 'The button is too small.' }));
+    assert.equal(kept.status, 201, await kept.clone().text());
+    assert.deepEqual(await kept.json(), { issue: { id: '1', identifier: 'FB-1' } });
+
+    assert.deepEqual(
+      (await notesOf(await visitor.read(SITE))).map((read) => read.note),
+      ['The button is too small.'],
+    );
+    assert.equal(await rowsIn(world), 1);
+  });
+
+  it('keeps the name the visitor typed, and never says the worker verified it', async () => {
+    const { site, visitor } = await workerWithASite('everyone');
+    // A visitor can type anything, a `verified` of their own included.
+    const typed = noteFor(site, {
+      reporter: { name: 'Alice', email: 'alice@acme.dev', verified: true } as Seed['reporter'],
+    });
+
+    assert.equal((await visitor.send(SITE, typed)).status, 201);
+
+    const [read] = await notesOf(await visitor.read(SITE));
+    assert.equal(read?.name, 'Alice');
+    assert.notEqual(read?.verified, true);
+  });
+
+  it('refuses a note and a read that name the site from the page of another site', async () => {
+    const { world, site, visitor } = await workerWithASite('everyone');
+    assert.equal((await visitor.send(SITE)).status, 201);
+    // Another workspace of the same worker has a site too: its origin is one the worker serves.
+    const other = await signInTo(world, 'bob@globex.dev');
+    const made = await callOn(
+      world,
+      'POST',
+      `/console/workspaces/${await workspaceIn(world, other.token, 'Globex')}/sites`,
+      {
+        token: other.token,
+        body: { url: SERVED, visibility: 'everyone' },
+      },
+    );
+    assert.equal(made.status, 201);
+
+    // Two refusals, by two checks. The origin of no site is refused before the site is looked for,
+    // and the origin of another site is refused for this one.
+    for (const [origin, error] of [
+      [NOWHERE, 'origin-not-allowed'],
+      [SERVED, 'origin-not-allowed-for-client'],
+    ] as const) {
+      for (const answer of [await visitor.send(origin), await visitor.read(origin)]) {
+        assert.equal(answer.status, 403, origin);
+        assert.deepEqual(await answer.json(), { error }, origin);
+      }
+    }
+    assert.equal(await rowsIn(world), 1);
+    // The site is not served under a name the worker does not know either.
+    assert.deepEqual(await (await visitor.read(SITE, `${site}x`)).json(), { error: 'unknown-client' });
+  });
+
+  it('serves the site at its origin alone: the address the admin pasted had a path and a query', async () => {
+    const { visitor } = await workerWithASite('everyone');
+
+    for (const origin of [`${SITE}:8443`, SITE.replace('https:', 'http:'), 'https://acme.test']) {
+      assert.equal((await visitor.read(origin)).status, 403, origin);
+    }
+    assert.equal((await visitor.read(SITE)).status, 200);
+  });
+});
+
+describe('a visitor with no account, on a site that its members read (FRU-224)', () => {
+  it('reads no note: the worker asks for a session, and says so', async () => {
+    const { visitor } = await workerWithASite('members');
+
+    const read = await visitor.read(SITE);
+
+    assert.equal(read.status, 401, await read.clone().text());
+    assert.deepEqual(await read.json(), { error: 'identity-required', reason: 'identity-required' });
+    // The control: the same request, on the same worker, for a site that everyone reads.
+    const open = await workerWithASite('everyone');
+    assert.equal((await open.visitor.read(SITE)).status, 200);
+  });
+
+  /**
+   * WARNING: this case holds what the worker does, and it is not a promise of the product.
+   * « Who reads » is what the visibility of a site decides (`read` of `clientOf`, `authorizeRead`).
+   * A note that comes with no token is a claim on every site (`attributionFor`), and is kept: a
+   * visitor of a site for members writes a note that they cannot read back. Whether such a site
+   * should refuse it is a question for Mathieu (FRU-224, FRU-184). The day it does, this case
+   * changes with `SECURITY.md`.
+   */
+  it('still takes a note sent with no session, which its sender cannot read back', async () => {
+    const { world, visitor } = await workerWithASite('members');
+
+    const sent = await visitor.send(SITE);
+
+    assert.equal(sent.status, 201, await sent.clone().text());
+    assert.equal(await rowsIn(world), 1);
+    assert.equal((await visitor.read(SITE)).status, 401);
+    // The note is one that nobody vouched for.
+    assert.notEqual(
+      (JSON.parse(String((await rowsOf(world.database, 'SELECT seed FROM seeds'))[0]?.seed)) as Seed).reporter
+        ?.verified,
+      true,
+    );
+  });
+
+  it('is the default of a site that the console makes with no visibility named', async () => {
+    const world = await envOf({ env: { FRUITBACK_STORE: 'postgres' } });
+    const admin = await signInTo(world, 'ana@acme.dev');
+    const workspace = await workspaceIn(world, admin.token);
+
+    const made = await callOn(world, 'POST', `/console/workspaces/${workspace}/sites`, {
+      token: admin.token,
+      body: { url: SITE },
+    });
+
+    assert.equal(((await made.json()) as { visibility: string }).visibility, 'members');
+  });
+});
diff --git a/docs/decisions/worker.md b/docs/decisions/worker.md
index 7f1d4f8a..6f67e4c1 100644
--- a/docs/decisions/worker.md
+++ b/docs/decisions/worker.md
@@ -1401,6 +1401,28 @@ an earlier migration, and writes nothing`.
 - **`migrate-to-postgres` does not read the switch.** It copies files into a server, and takes
   `FRUITBACK_DATABASE_URL` alone.
 
+## A visitor with no account (FRU-224)
+
+- **A visitor leaves a note with no account on a site that everyone reads.** Mathieu, 2026-10-13:
+  an account is always possible for whoever administers, and is not needed to leave a note. The
+  code did it already. `visitor.test.ts` now holds the whole path on a worker whose sites come from
+  the console: the tests that did ran on `FRUITBACK_CLIENTS`, which is going (FRU-184).
+  `e2e/visitor.spec.ts` holds it in a browser, where CORS is what stops a page of another origin.
+- **Played backwards.** With the origin of the site not checked (`resolveClient`), one test of
+  `visitor.test.ts` fails. With the visibility not read (`clientOf`), two fail.
+- **Two checks refuse an origin, and the test names both.** An origin that is no site of the worker
+  is refused before the site is looked for (`origin-not-allowed`). The origin of another site, of
+  any workspace, is refused for this site (`origin-not-allowed-for-client`).
+- **Measured, and not decided here: a site for members takes a note that has no session.** The
+  visibility is the rule of the reads. The ticket said that such a site « asks for a session »:
+  that is true of a read. test:`still takes a note sent with no session, which its sender cannot
+read back` holds what the worker does, and `SECURITY.md` says it. Refusing that note is a change of
+  `attributionFor`, and a question for Mathieu.
+- **Not decided: the token signed by the site.** A site that has its own login signs a token with
+  the `identitySecret` of its client, in `FRUITBACK_CLIENTS`. A site of the console has no secret.
+  A secret for each site, or the end of that way of working: FRU-184 asks, and nothing here
+  changes it. `docs/modes.md` says what holds today.
+
 ## The notes in PostgreSQL (FRU-218)
 
 Mathieu decided on 2026-10-13 that a worker always has PostgreSQL, self-hosted too. Nothing can take
diff --git a/docs/modes.md b/docs/modes.md
index cd951ff4..1e88a7be 100644
--- a/docs/modes.md
+++ b/docs/modes.md
@@ -55,6 +55,22 @@ holds, and only the relay carries it. Their name and address on a note are self-
 in a public-mode site that supplies no token — `reporter.verified` is the worker's word and it
 withholds it.
 
+## On a worker with accounts: the visibility of a site is `read`
+
+A worker with a database (`FRUITBACK_DATABASE_URL`) reads its sites from the console, and
+`FRUITBACK_READ` does not apply to it. Each site says who reads it:
+
+- **`everyone`** is `read: 'public'`. A visitor needs no account, no extension and no token to
+  leave a note and to see the pins: this is the public mode, and the reporter is self-declared.
+- **`members`** is `read: 'authenticated'`. A read needs the session of a member of the workspace,
+  which the extension gets by pairing: this is the team mode.
+
+**The token that the host's own backend mints does not exist there.** A site of the console has no
+secret of its own, so `init({ identityToken })` has nothing to sign with: the second line of « So »
+above, « a site with its own login », is for a worker of `FRUITBACK_CLIENTS` only. Whether a site
+of the console gets such a secret, or that way of working goes with `FRUITBACK_CLIENTS` (FRU-184),
+is not decided.
+
 ## Private mode is not going away
 
 Team mode covers a team reviewing its own product, which private mode served awkwardly: it asked a
diff --git a/e2e/visitor.spec.ts b/e2e/visitor.spec.ts
new file mode 100644
index 00000000..2f8b7f6a
--- /dev/null
+++ b/e2e/visitor.spec.ts
@@ -0,0 +1,116 @@
+import { type Request, expect, test } from '@playwright/test';
+import { CONSOLE } from './cloud-worker.ts';
+import { WORKER_ORIGIN, openPlayground, pinFor, plantPin, waitForPins } from './pin.ts';
+import { AUTHENTICATED_WORKER_ORIGIN } from './worker-sessions.ts';
+
+/**
+ * A visitor with no account leaves a note, in a browser, on a worker that has accounts (FRU-224).
+ *
+ * Each worker of the suite keeps its sites in a database (`dev-worker.fixture.ts`): the one on 8788
+ * has the site `playground`, which everyone reads, and the one on 8789 has it for its members only.
+ * The page of this spec has no extension, no session and no cookie, as the page of a visitor. What
+ * a browser adds to `visitor.test.ts` of the worker is CORS: a page of another origin must not read
+ * the answer, and `curl` cannot show that.
+ */
+
+const feedback = (request: Request): boolean => new URL(request.url()).pathname === '/feedback';
+
+test('a visitor plants a pin and finds it again, and no request carried a credential', async ({ page }) => {
+  const sent: Request[] = [];
+  page.on('request', (request) => {
+    if (request.url().startsWith(WORKER_ORIGIN) && feedback(request)) sent.push(request);
+  });
+
+  await openPlayground(page, 'visitor');
+  const button = page.locator('[data-testid="card-latte"] .add');
+  await plantPin(page, button, 'Une note de quelqu’un qui n’a pas de compte');
+  await page.reload();
+  await waitForPins(page, 1);
+  await expect(pinFor(page, 'Une note de quelqu’un')).toBeVisible();
+
+  // The write, and a read before and after it: the control of the loop below.
+  expect(sent.map((request) => request.method())).toEqual(expect.arrayContaining(['POST', 'GET']));
+  for (const request of sent) {
+    const headers = await request.allHeaders();
+    expect(headers.authorization, `${request.method()} ${request.url()}`).toBeUndefined();
+    expect(headers.cookie, `${request.method()} ${request.url()}`).toBeUndefined();
+    expect(headers.origin ?? new URL(page.url()).origin).toBe(new URL(page.url()).origin);
+  }
+  expect(await page.context().cookies(WORKER_ORIGIN)).toEqual([]);
+});
+
+test('a page of another origin reads no note of the site, and plants none', async ({ page, baseURL }) => {
+  await openPlayground(page, 'visitor-elsewhere');
+  await plantPin(page, page.locator('#checkout-cta'), 'Une note que seul ce site lit');
+  const address = new URL(page.url());
+  address.hash = '';
+  const read = `${WORKER_ORIGIN}/feedback?url=${encodeURIComponent(address.toString())}&client=playground`;
+
+  // The control: the page of the site reads its note with the same request.
+  const own = await page.evaluate(async (url) => {
+    const response = await fetch(url);
+
+    return { status: response.status, notes: ((await response.json()) as { issues: unknown[] }).issues.length };
+  }, read);
+  expect(own).toEqual({ status: 200, notes: 1 });
+
+  // The console of the suite is a page of another origin, in the same browser.
+  expect(new URL(CONSOLE).origin).not.toBe(new URL(baseURL ?? '').origin);
+  const elsewhere = await page.context().newPage();
+  await elsewhere.goto(`${CONSOLE}/sign-in`);
+  const refused = await elsewhere.evaluate(
+    async ({ url, worker }) => {
+      const attempt = async (input: string, init?: RequestInit): Promise<string> => {
+        try {
+          const response = await fetch(input, init);
+
+          return `answered ${response.status}: ${await response.text()}`;
+        } catch (error) {
+          // What a browser gives a page whose origin the worker did not allow: no status, no body.
+          return `failed: ${error instanceof TypeError ? 'TypeError' : String(error)}`;
+        }
+      };
+
+      return {
+        read: await attempt(url),
+        write: await attempt(`${worker}/feedback`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ client: { id: 'playground' } }),
+        }),
+      };
+    },
+    { url: read, worker: WORKER_ORIGIN },
+  );
+  expect(refused).toEqual({ read: 'failed: TypeError', write: 'failed: TypeError' });
+
+  // What the worker answered, which the page could not read: the same request, sent from here with
+  // the `Origin` of that page. Without this, a worker that was down would pass the lines above.
+  const answered = await fetch(read, { headers: { Origin: new URL(CONSOLE).origin } });
+  expect(answered.status).toBe(403);
+  expect(answered.headers.get('access-control-allow-origin')).toBeNull();
+  // And nothing of that page was kept.
+  const after = await (await fetch(read, { headers: { Origin: new URL(baseURL ?? '').origin } })).json();
+  expect((after as { issues: unknown[] }).issues).toHaveLength(1);
+});
+
+test('on a site that its members read, a visitor reads no note', async ({ page }) => {
+  await openPlayground(page, 'visitor-members');
+  const address = new URL(page.url());
+  address.hash = '';
+
+  const answers = await page.evaluate(
+    async ({ url, workers }) =>
+      Promise.all(
+        workers.map(async (worker) => {
+          const response = await fetch(`${worker}/feedback?url=${encodeURIComponent(url)}&client=playground`);
+
+          return response.status;
+        }),
+      ),
+    { url: address.toString(), workers: [AUTHENTICATED_WORKER_ORIGIN, WORKER_ORIGIN] },
+  );
+
+  // The same page, the same site id, two workers: only the visibility of the site differs.
+  expect(answers).toEqual([401, 200]);
+});

From f198b62767b69fdb0b0b29e6dcc343dd12171864 Mon Sep 17 00:00:00 2001
From: Mathieu Audebert <mathieu@sakuga.dev>
Date: Tue, 13 Oct 2026 17:55:02 +0200
Subject: [PATCH 2/3] test(e2e): the Origin of each request of a visitor is the
 page's, with no fallback (FRU-224)

Raised in review: the assertion fell back to the origin of the page when the header was absent, and
then compared the page with itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 e2e/visitor.spec.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/e2e/visitor.spec.ts b/e2e/visitor.spec.ts
index 2f8b7f6a..e9c26454 100644
--- a/e2e/visitor.spec.ts
+++ b/e2e/visitor.spec.ts
@@ -34,7 +34,8 @@ test('a visitor plants a pin and finds it again, and no request carried a creden
     const headers = await request.allHeaders();
     expect(headers.authorization, `${request.method()} ${request.url()}`).toBeUndefined();
     expect(headers.cookie, `${request.method()} ${request.url()}`).toBeUndefined();
-    expect(headers.origin ?? new URL(page.url()).origin).toBe(new URL(page.url()).origin);
+    // The worker is another origin than the page: the browser sends `Origin` on every request to it.
+    expect(headers.origin, `${request.method()} ${request.url()}`).toBe(new URL(page.url()).origin);
   }
   expect(await page.context().cookies(WORKER_ORIGIN)).toEqual([]);
 });

From 6e1886a43c5c39e5fa6e74eb850c2818db4e2864 Mon Sep 17 00:00:00 2001
From: Mathieu Audebert <mathieu@sakuga.dev>
Date: Tue, 13 Oct 2026 18:09:21 +0200
Subject: [PATCH 3/3] test(worker): the control of the read of a site for
 members is in the same world (FRU-224)

Raised in review: the case opened a second PGlite world, and a process holds one PGlite database at
a time. The control reads a site of the same workspace that everyone reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/worker/src/visitor.test.ts | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/apps/worker/src/visitor.test.ts b/apps/worker/src/visitor.test.ts
index 04202b00..9e262bfa 100644
--- a/apps/worker/src/visitor.test.ts
+++ b/apps/worker/src/visitor.test.ts
@@ -155,15 +155,23 @@ describe('a visitor with no account, on a site that everyone reads (FRU-224)', (
 
 describe('a visitor with no account, on a site that its members read (FRU-224)', () => {
   it('reads no note: the worker asks for a session, and says so', async () => {
-    const { visitor } = await workerWithASite('members');
+    const { world, admin, workspace, store, visitor } = await workerWithASite('members');
 
     const read = await visitor.read(SITE);
 
     assert.equal(read.status, 401, await read.clone().text());
     assert.deepEqual(await read.json(), { error: 'identity-required', reason: 'identity-required' });
-    // The control: the same request, on the same worker, for a site that everyone reads.
-    const open = await workerWithASite('everyone');
-    assert.equal((await open.visitor.read(SITE)).status, 200);
+    // The control, in the same world (one PGlite database for a process at a time, raised in
+    // review): the same read, from a page of a site of the same workspace that everyone reads.
+    const docs = 'https://docs.acme.test';
+    const made = await callOn(world, 'POST', `/console/workspaces/${workspace}/sites`, {
+      token: admin.token,
+      body: { url: docs, visibility: 'everyone' },
+    });
+    const open = ((await made.json()) as { id: string }).id;
+    const page = encodeURIComponent(canonicalizePageUrl(`${docs}/start`));
+    const control = await callOn(world, 'GET', `/feedback?url=${page}&client=${open}`, { origin: docs }, { store });
+    assert.equal(control.status, 200, await control.clone().text());
   });
 
   /**